Phishing Page Loads Enterprise Branding after Email Submission
Detects a two-stage credential page that receives an email address and then requests tenant branding or a password form during the same browser session. This behavior is indicative of advanced phishing attacks that attempt to mimic legitimate login flows.
Microsoft Sentinel (KQL)
